How to solve session issue when enabling EncryptCookie in Laravel 5.7?

Question

Laravel

Faced with the problem that after the transfer of the project to the server, the session is created with each request. Sessions are stored in files, and each request creates a new file with content.
We found a dependency in the following, sessions start working correctly if EncryptCookies is removed from the web route group . Therefore, I wonder what exactly is the problem and how does it affect the sessions themselves?

// app/Http/Kernel.php

protected $middlewareGroups = [
        'web' => [
            \Illuminate\Cookie\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ]
    ];

Answer 1

In general, the problem turned out to be in the php config, the mbstring.func_overload 2 parameter was enabled. And there the random_bytes method did not work correctly along the chain, i.e. it gave out a string whose length strlen did not consider correctly. As a result, the cookie validity check method returned false.
Since php7 the composer will throw an error that this option should be turned off, so I doubt that anyone else will run into this problem.

Answer 2

You can simply leave EncryptCookies on and add the name of the cookie to the $except array inside this class so that it is not encrypted. The session ID is stored in a cookie that has a lifetime and is encrypted to prevent the cookie from being intercepted over the network or from the user's device. The session will "disappear" with each request only if there is no file with the session on the server (for example, when balancing requests between different php servers in the pool) or the cookie with the identifier will not be sent by the browser. I think the problem is most likely something else.